WordPress core get_page_template path traversal enables unauthenticated RCE
Path traversal in WordPress core's get_page_template() enables unauthenticated local PHP file inclusion and conditional RCE. Actively exploited within 24 hours of disclosure. CVSS 8.1 High.
- Vendor
- WordPress
- Product
- WordPress Core
- CVSS
- 8.1
- EPSS (exploit probability)
- 2.9%
- Status
- exploited-in-wild
- Published
CVE-2026-87902 is a path traversal vulnerability in WordPress core’s page-template resolution mechanism. Per NVD, published September 22, 2026: an unauthenticated attacker can manipulate how get_page_template() resolves page templates, causing it to include a chosen readable local .php file from outside the active theme directories. Remote code execution is possible when specific preconditions at both the server and active theme are met. Those preconditions are not fully specified in the public NVD record.
Exploitation status
Active exploitation confirmed. BleepingComputer reported September 23, 2026 that attackers moved from reconnaissance to writing files to disk that execute shell commands when accessed. Exploitation began within 24 hours of the public advisory. SecurityWeek independently confirmed exploitation started immediately after disclosure.
CVSS note
NVD assigns CVSS 8.1 High. Some outlets reported a vendor-side score of 9.8 Critical. The 8.1 score reflects the conditional RCE path: reaching code execution requires specific server and active-theme conditions to align.
Patch
A WordPress core fix is available, per SecurityWeek. Auto-update-enabled installs should have received it automatically.
Full coverage: WordPress Core RCE Flaw CVE-2026-87902 Under Active Exploit.
